YaPI::LdapServer
This package is the public Yast2 API to managing a LDAP Server.
use YaPI::LdapServer
$bool = Init()
Initializes the API, needs to be called first, before any
other API call.
\@dbList = ReadDatabaseList()
Returns a list of configured databases.
$bool = AddDatabase(\%valueMap)
Creates a new database
$bool = EditDatabase($suffix,\%valueMap)
Edit the database section with the suffix $suffix.
\%valueMap = ReadDatabase($suffix)
Read the database section with the suffix $suffix.
\@indexList = ReadIndex($suffix)
Returns a List of Maps with all index statements for this database
$bool = EditIndex($suffix,\%indexMap)
Add a new index statement %indexMap to the database section
\@aclList = ReadAcl($suffix)
Returns a List of Maps with the ACL for this database
$bool = WriteAcl($suffix,\@aclList)
Replace the existing ACLs of a database
\@list = ReadSchemaList()
Returns a list of all included schema items
$bool = AddSchema($schemaFile)
Add an additional Schema item
\@list = ReadAllowList()
Returns a list of allow statements.
$bool = WriteAllowList(\@list)
Replaces the complete allow option with the specified list
$loglevel = ReadLoglevel()
Read the loglevel bitmask.
$bool = AddLoglevel($bit)
Set the given loglevel bit to 1 in the current bitmask.
$bool = DeleteLoglevel($bit)
Set the given loglevel bit to 0 in the current bitmask.
$bool = WriteLoglevel($loglevel)
Replaces the loglevel bitmask.
ModifyService($status)
Turn on/of the LDAP server runnlevel script
SwitchService($status)
Start/Stop the LDAP server
$status = ReadService()
Read out the state of the LDAP server runlevel script
\%valueMap = ReadTLS()
Return the current TLS settings
$bool = WriteTLS(\%valueMap)
Write the TLS options in the configuration file.
$bool = CheckCommonServerCertificate()
Check, if a common server certificate is available.
$bool = ConfigureCommonServerCertificate()
Configure the LDAP server to use the common server certificate.
$bool = ImportCertificates(\%valueMap)
Import certificates and configure TLS for the LDAP Server.
$bool = ReadSLPEnabled()
Read if SLP is enabled in /etc/sysconfig/openldap
$bool = WriteSLPEnabled($bool)
Activate/Deactivate SLP Registering in /etc/sysconfig/openldap
\$bool = Init()
Initializes the API, needs to be called first, before any other API call.
\@dbList = ReadDatabaseList()
Returns a List of databases. Each element of the list is a hash reference with the following elements:
* 'index' : The index of the database. Frontend Database has index -1,
config database has index 0 and first "real" database has index 1.
* 'suffix': The base DN the database is servinng e.g. 'dc=example,dc=com'
* 'type': The database type e.g. 'bdb' or 'config'
EXAMPLE:
use Data::Dumper;
my $res = YaPI::LdapServer->ReadDatabaseList();
if( not defined $res ) {
# error
} else {
print "OK: \n";
print STDERR Data::Dumper->Dump([$res])."\n";
}
$bool = AddDatabase(\%valueMap)
Creates a new database section in the configuration file, start or restart the LDAP Server and add the base object. If the database exists, nothing is done and undef is returned.
Supported keys in %valueMap are:
* type: The database type (required)
* suffix: The suffix (required)
* directory: The Directory where the database files are(bdb/ldbm) (required)
* createdatabasedir: If true the directory for the database will be created (optional; default false)
* rootdn: The Root DN
* rootpw: The hashed RootDN Password (requires rootdn)
* rootpw_clear: The plain Root Password (requires rootdn)
* cryptmethod: The crypt method; allowed values are (CRYPT, SMD5, SHA, SSHA, PLAIN); default is 'SSHA'
* entrycache: The cachesize (optional; default 10000)
* idlcache: The cachesize (optional; default 10000)
* checkpoint: The bdb checkpoint setting as an array reference (optional; default [1024, 5])
If no rootdn and passwd is set, the base object is not added to the LDAP server.
EXAMPLE:
my $hash = {
database => 'bdb',
suffix => 'dc=example,dc=com',
rootdn => "cn=Admin,dc=example,dc=com",
rootpw_clear => "system",
cryptmethod => 'SMD5',
directory => "/var/lib/ldap/db1",
};
my $res = YaPI::LdapServer->AddDatabase($hash);
if( not defined $res ) {
# error
} else {
print "OK: \n";
}
$bool = EditDatabase($suffix,\%valueMap)
Edit the database section with the suffix $suffix in the configuration file. Only save parameter are supported.
You have to restart the LDAP Server with YaPI::LdapServer->SwitchService(1) to activate these changes.
Supported keys in %valueMap are:
* rootdn: The Root DN
* rootpw: The Root Password
* rootpw_clear: The cleartext Root Password
* cryptmethod: The crypt method; allowed values are (CRYPT, SMD5, SHA, SSHA, PLAIN); default is 'SSHA'
If a key is not defined, the option is not changed. If the key is defined and a value is specified, this value will be set.
If you delete rootdn, rootpw is also deleted.
EXAMPLE:
my $hash = { suffix => "dc=example,dc=com",
rootdn => "cn=Administrator,dc=example,dc=com",
rootpw => "example",
cryptmethod => "CRYPT"
};
my $res = YaPI::LdapServer->EditDatabase($hash);
if( not defined $res ) {
# error
} else {
print "OK: \n";
}
\%valueMap = ReadDatabase($suffix)
Read the database section with the suffix $suffix.
Returned keys in %valueMap are:
* type: The database type
* suffix: The suffix
* rootdn: The Root DN
* rootpw: The Root Password Hash
* directory: The Directory where the database files are (bdb/hdb)
* entrycache: The size of the entrycache
* idlcache: The size of the idlcache
* checkpoint: The checkpoint setting (A reference to a list see
AddDatabase()
There can be some more, depending on the database's configuration
EXAMPLE:
use Data::Dumper;
my $res = YaPI::LdapServer->ReadDatabase('"dc=example,dc=com"');
if( not defined $res ) {
# error
} else {
print "OK: \n";
print STDERR Data::Dumper->Dump([$res])."\n";
}
\@indexList = ReadIndex($suffix)
Returns a Map of Maps with all defined indexes for a database. The keys of the outer Map are LDAP Attribute Type (e.g. 'objectClass'), the keys in the inner Maps are booleans for the specific type of indexes.
{
'objectClass' => {
'eq' => 1
},
'cn' => {
'sub' => 1,
'pres' => 1,
'eq' => 1
}
}
EXAMPLE:
use Data::Dumper;
my $res = YaPI::LdapServer->ReadIndex('"dc=example,dc=com"');
if( not defined $res ) {
# error
} else {
print "OK: \n";
print STDERR Data::Dumper->Dump([$res])."\n";
}
$bool = EditIndex($suffix,\%indexMap)
Add/or change the indexing of a single AttributeType.
The indexMap has up to four keys
* 'name', A single AttributeType
* 'eq', A boolean to indicate whether an equality index should be created
* 'sub', A boolean to indicate whether a substring index should be created
* 'pres', A boolean to indicate whether a presence index should be created
EXAMPLE:
my $newIndex = {
'name' => "uid",
'eq' => 1,
'pres' => 1,
'sub' => 0
};
my $res = YaPI::LdapServer->EditIndex("dc=example,dc=com", $newIndex);
if( not defined $res ) {
# error
} else {
print "OK: \n";
}
\@aclList = ReadAcl($suffix)
Read ACLs of a Database
The return value is a list of maps defining the ACLs. The maps
has the following structure:
{
'target' => {
# a Map defining the target objects of this ACL
# can contain any or multiple keys of the following
# types
'attrs' => [ <list of attributetypes> ],
'filter' => <LDAP filter string>,
'dn' => {
'style' => <'base' or 'subtree'>
'value' => <LDAP DN>
}
},
'access' => [
# a list of maps defining the access level of different
# indentities, each map looks like this:
'level' => <'none'|'disclose'|'auth'|'compare'|'read'|'write'|'manage'>,
'type' => <'self'|'users'|'anoymous'|'*'|'group'|'dn.base'|'dn.subtree'>
# if type is 'group', 'dn.base', 'dn.subtree':
'value' => <a valid LDAP DN>
]
}
$bool = WriteAcl($suffix,\@aclList)
Update the ACLs of a Database, all exiting ACLs of that Database are overwritten.
The aclList parameter must have the same structure as documented for the
ReadAcl function above.
\@list = ReadSchemaList()
Returns a list of all included schemas items
EXAMPLE:
use Data::Dumper;
my $res = YaPI::LdapServer->ReadSchemaList();
if( not defined $res ) {
# error
} else {
print "OK: \n";
print STDERR Data::Dumper->Dump([$res])."\n";
}
$bool = AddSchema($file)
Adds an additional schema item. $file is the absolute pathname of the file to add. It can either be in .schema or LDIF format.
EXAMPLE:
my $res = YaPI::LdapServer->AddSchema("/etc/openldap/schema/ppolicy.schema");
if( not defined $res ) {
# error
} else {
print "OK: \n";
}
\@list = ReadAllowList()
Returns a list of allow statements.
EXAMPLE:
use Data::Dumper;
my $res = YaPI::LdapServer->ReadAllowList();
if( not defined $res ) {
# error
} else {
print "OK: \n";
print STDERR Data::Dumper->Dump([$res])."\n";
}
$bool = WriteAllowList(\@list)
Replaces the complete allow option with the specified feature list.
You have to restart the LDAP Server with YaPI::LdapServer->SwitchService(1) to activate these changes.
EXAMPLE:
my @list = ( "bind_v2" );
$res = YaPI::LdapServer->WriteAllowList( \@list );
if( not defined $res ) {
# error
} else {
print "OK: \n";
}
$loglevel = ReadLoglevel()
Read the loglevel bitmask.
EXAMPLE:
my $res = YaPI::LdapServer->ReadLoglevel();
if( not defined $res ) {
} else {
print "OK: \n";
print STDERR Data::Dumper->Dump([$res])."\n";
}
$bool = AddLoglevel($bit)
Set the given loglevel bit to 1 in the current bitmask.
You have to restart the LDAP Server with YaPI::LdapServer->SwitchService(1) to activate these changes.
EXAMPLE:
my $res = YaPI::LdapServer->AddLoglevel( 0x04 );
if( not defined $res ) {
# error
} else {
print "OK: \n";
}
$bool = DeleteLoglevel($bit)
Set the given loglevel bit to 0 in the current bitmask.
You have to restart the LDAP Server with YaPI::LdapServer->SwitchService(1) to activate these changes.
EXAMPLE:
my $res = YaPI::LdapServer->DeleteLoglevel( 0x04 );
if( not defined $res ) {
} else {
print "OK: \n";
}
$bool = WriteLoglevel($loglevel)
Replaces the loglevel bitmask.
You have to restart the LDAP Server with YaPI::LdapServer->SwitchService(1) to activate these changes.
EXAMPLE:
my $res = YaPI::LdapServer->WriteLoglevel( 0x06 );
if( not defined $res ) {
} else {
print "OK: \n";
}
ModifyService($status)
with this function you can turn on and off the LDAP server runlevel script. Turning off means, no LDAP server start at boot time.
EXAMPLE
ModifyService(0); # turn LDAP server off at boot time
ModifyService(1); # turn LDAP server on at boot time
SwitchService($status)
with this function you can start and stop the LDAP server service.
EXAMPLE
SwitchService( 0 ); # turning off the LDAP server service
SwitchService( 1 ); # turning on the LDAP server service
$status = ReadService()
with this function you can read out the state of the LDAP server runlevel script (starting LDAP server at boot time).
EXAMPLE
print "LDAP is ".( (ReadService())?('on'):('off') )."\n";
\%valueMap = ReadTLS()
Return the current TLS settings
Supported keys in %valueMap are:
* TLSCipherSuite: cipher suite parameter
* TLSCACertificateFile: Specifies the file that contains certificates for all of the Certificate Authorities that slapd will recognize.
* TLSCACertificatePath: Specifies the path of a directory that contains Certificate Authority certificates in separate individual files. Usually only one of this or the TLSCACertificateFile is used.
* TLSCertificateFile: Specifies the file that contains the slapd server certificate.
* TLSCertificateKeyFile: Specifies the file that contains the slapd server private key.
* TLSVerifyClient: Specifies what checks to perform on client certificates in an incoming TLS session.
EXAMPLE:
use Data::Dumper;
my $res = YaPI::LdapServer->ReadTLS();
if( not defined $res ) {
# error
} else {
print "OK: \n";
print STDERR Data::Dumper->Dump([$res])."\n";
}
$bool = WriteTLS(\%valueMap)
Edit the TLS options in the configuration file.
You have to restart the LDAP Server with YaPI::LdapServer->SwitchService(1) to activate these changes.
Supported keys in %valueMap are:
* TLSCipherSuite: cipher suite parameter
* TLSCACertificateFile: Specifies the file that contains certificates for all of the Certificate Authorities that slapd will recognize.
* TLSCACertificatePath: Specifies the path of a directory that contains Certificate Authority certificates in separate individual files. Usually only one of this or the TLSCACertificateFile is used.
* TLSCertificateFile: Specifies the file that contains the slapd server certificate.
* TLSCertificateKeyFile: Specifies the file that contains the slapd server private key.
* TLSVerifyClient: Specifies what checks to perform on client certificates in an incoming TLS session.
If the key is defined, but the value is 'undef' the option will be deleted. If a key is not defined, the option is not changed. If the key is defined and a value is specified, this value will be set.
EXAMPLE:
my $hash = {
TLSCipherSuite => "HIGH:MEDIUM:+SSLv2",
TLSCertificateFile => "/etc/ssl/server_crt.pem",
TLSCertificateKeyFile => "/etc/ssl/server_key.pem",
TLSCACertificateFile => "/etc/ssl/ca.pem",
TLSVerifyClient => "never"
};
my $res = YaPI::LdapServer->WriteTLS($hash);
if( not defined $res ) {
# error
} else {
print "OK: \n";
}
$bool = CheckCommonServerCertificate()
Check, if a server certificate is available which can be used for more then one service. Such common certificate is saved at '/etc/ssl/servercerts/servercert.pem'.
This function returns 'true' if such a certificate is available and 'false' if not.
EXAMPLE:
my $res = YaPI::LdapServer->CheckCommonServerCertificate();
if( not defined $res ) {
# error
} else {
print "Available \n" if($res);
print "Not Avalable \n" if(!res);
}
$bool = ConfigureCommonServerCertificate()
Configure the LDAP server to use the common server certificate.
At first this function try to set read permissions for user ldap on the common private key via filesystem acls. After that it modifies the slapd.conf and add/edit the TLS pararamter.
You have to restart the LDAP Server with YaPI::LdapServer->SwitchService(1) to activate these changes.
EXAMPLE:
my $res = YaPI::LdapServer->ConfigureCommonServerCertificate();
if( not defined $res ) {
# error
} else {
print "OK: \n";
}
$bool = ImportCertificates(\%valueMap)
Import certificates and configure TLS for the LDAP Server.
The following Keys are possible in %valueMap:
* ServerCertificateFile (required)
* ServerKeyFile (required)
* CACertificatesFile (optional)
The file format must be PEM.
Alternative you can send the PEM data direct via:
* ServerCertificateData (required)
* ServerKeyData (required)
* CACertificatesData (optional)
The return value is 'true' on success and 'undef' on an error.
EXAMPLE:
my $hash = {
ServerCertificateFile => '/path/to/the/certificate.pem',
ServerKeyFile => '/path/to/the/key.pem',
CACertificatesFile => '/path/to/the/CAcertificate.pem',
}
my $res = YaPI::LdapServer->ImportCertificates($hash);
if( not defined $res ) {
# error
} else {
print "OK: \n";
}
$bool = ReadSLPEnabled()
This function reads the OPENLDAP_REGISTER_SLP entry in /etc/sysconfig/openldap. It returns 'true' if it reads 'yes' and 'false' if it reads 'no'.
EXAMPLE
print "SLP registering is ".( (ReadSLPEnabled())?('activated'):('deactivated') )."\n";
$bool = WriteSLPEnabled( $bool )
This function sets OPENLDAP_REGISTER_SLP in /etc/sysconfig/openldap. The entry is set to 'yes' if the argument is true or 'no' if the argument is false.
The return value is true on success, undef on error.
EXAMPLE
WriteSLPEnabled( 1 );
Hey! The above document had some coding errors, which are explained below:
=over without closing =back