{"id":2534,"date":"2021-05-27T08:00:10","date_gmt":"2021-05-27T06:00:10","guid":{"rendered":"https:\/\/possiblelossofprecision.net\/?p=2534"},"modified":"2022-02-15T12:31:43","modified_gmt":"2022-02-15T10:31:43","slug":"ldap-server-with-389ds-part-2-quality-of-life-plugins","status":"publish","type":"post","link":"https:\/\/possiblelossofprecision.net\/?p=2534","title":{"rendered":"LDAP server with 389ds: Part 2 – Quality-of-life plugins"},"content":{"rendered":"

In part 1<\/a> we’ve looked at how to install 389 Directory Server<\/a> and create an instance. While this left us with a fully working LDAP server there are some plugins that greatly increase quality of life and might even be considered essential.<\/p>\n

<\/p>\n

3. Plugins<\/h2>\n

3.1. Attribute Uniqueness<\/h3>\n

Certain attributes can have duplicate values within a directory. A simple example is a user’s first name which is stored in the givenName<\/code> attribute. In a directory with a sufficiently large number of users it’s more likely than not that there are two or more users with the same first name.
\nBut how about a user’s email address? If the mail<\/code> attribute wasn’t unique within the whole directory this could lead to some trouble when delivering emails to a user’s inbox. Of course, a directory administrator might be careful when creating new users and ensure that each user has their own, unique email address. But humans make mistakes and checking manually if a certain email address is not already used is cumbersome at least.<\/p>\n

The 389 directory server has a built-in plugin that can guarantee the uniqueness of attributes across the entire directory information tree (DIT) or even just certain subtrees. It can be conveniently configured and enabled through dsconf<\/code>.
\nLet’s say we wanted to guarantee that email addresses are unique across our whole dc=example,dc=com<\/code> tree, we would run:<\/p>\n

\r\ndsconf localhost plugin attr-uniq add "mail attribute uniqueness" --attr-name mail --subtree "dc=example,dc=com"\r\ndsconf localhost plugin attr-uniq enable "mail attribute uniqueness"\r\n<\/pre>\n
Other very commonly unique attributes are a user’s ID (uid<\/code>), uid number (the integer uniquely identifying a user, uidNumber<\/code>) and gid number (the integer uniquely identifying a user’s primary group, gidNumber<\/code>). This is not a exhaustive list, of course, and which attributes are unique in a directory may very well depend on the use case. But together with the mail<\/code> attribute it’s probably a good starting point:<\/p>\n
\r\ndsconf localhost plugin attr-uniq add "mail attribute uniqueness" --attr-name mail --subtree "dc=example,dc=com"\r\ndsconf localhost plugin attr-uniq add "uid attribute uniqueness" --attr-name uid --subtree "dc=example,dc=com"\r\ndsconf localhost plugin attr-uniq add "uidNumber attribute uniqueness" --attr-name uidNumber --subtree "dc=example,dc=com"\r\ndsconf localhost plugin attr-uniq add "gidNumber attribute uniqueness" --attr-name gidNumber --subtree "dc=example,dc=com"\r\ndsconf localhost plugin attr-uniq enable "mail attribute uniqueness"\r\ndsconf localhost plugin attr-uniq enable "uid attribute uniqueness"\r\ndsconf localhost plugin attr-uniq enable "uidNumber attribute uniqueness"\r\ndsconf localhost plugin attr-uniq enable "gidNumber attribute uniqueness"\r\n<\/pre>\n
The attr-uniq<\/code> plugin can also ensure uniqueness of values across multiple attributes. That’s called Multi Valued Uniqueness<\/em> and is done by specifying multiple attribute names<\/a>:<\/p>\n
\r\ndsconf localhost plugin attr-uniq add "mail attribute uniqueness" --attr-name mail --attr-name mailAlternateAddress --subtree "dc=example,dc=com"\r\n<\/pre>\n
Note that the 389ds instance has to be restarted in order for the plugin to work (even though it was enabled through dsconf<\/code>:<\/p>\n
\r\ndsctl localhost restart\r\n<\/pre>\n
3.2. Distributed Numeric Assignment<\/h3>\n
Similarly to manually checking for certain attributes to be unique it’s cumbersome to manually assign and manage uidNumber<\/code> and gidNumber<\/code> attributes. Fortunately this can be automatically handled by the Distributed Numeric Assignment (DNA) plugin<\/a>.<\/p>\n
The plugin settings can be configured through dsconf<\/code> again:<\/p>\n
\r\ndsconf localhost plugin dna config "Account IDs" add \\\r\n  --type gidNumber uidNumber \\\r\n  --filter "(objectclass=posixAccount)" \\\r\n  --scope ou=People,dc=example,dc=com \\\r\n  --next-value 1001 \\\r\n  --magic-regen -1\r\n<\/pre>\n
The parameters should be quite self-explanatory. Here’s a quick overview anyway:<\/p>\n