How to Create LDAP Users and Groups using LDIF file
If you are interested in learning, Request you to go through the below recommended tutorial.
DevOps Full Course Tutorial for Beginners – DevOps Free Training Online
Docker Full Course Tutorial for Beginners – Docker Free Training Online
Kubernetes Full Course Tutorial for Beginners – Kubernetes Free Training Online
Ansible Full Course Tutorial for Beginners – Ansible Free Training Online
Openstack Full Course Tutorial for Beginners – Openstack Free Training Online
Configure Linux Clients for LDAP Authentication to OpenLDAP Server
Else if you use a LDIF file, authentication will happen from Ldap server and home directory will be created under each server.
For this demo, I have a running Openldap Server with following details and we are going to create a user called “newuser1” with UID 1010 and GID 1010.
Ldap Server name : ldapserver1.learnitguide.net (dc=learnitguide,dc=net)
Client Server name : Client1.learnitguide.net
How to Create LDAP Users and Groups using LDIF file
Lets get started.
Use the ldapsearch command to print the object class details of an existing Ldap user “ldapuser1”.
[root@ldapserver1 ~]# ldapsearch -x cn=ldapuser1 -b dc=learnitguide,dc=net
# extended LDIF
#
# LDAPv3
# base <dc=learnitguide,dc=net> with scope subtree
# filter: cn=ldapuser1
# requesting: ALL
#
# ldapuser1, People, learnitguide.net
dn: uid=ldapuser1,ou=People,dc=learnitguide,dc=net
uid: ldapuser1
cn: ldapuser1
sn: ldapuser1
mail: ldapuser1@learnitguide.net
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword:: e2NyeXB0fSQ2JGVjYUFGNGxEJGV3aTYyMjBJNi8xamd4SWtuWjZzSnZ3SFRiNnd
wUzNGV2NWYmRqS1pia2twTTAyYk8yUnF0U1JUV25TY0hxUWdJQzFOYzVLRWlmcWZ2b1BWWHMuRjUv
shadowLastChange: 17449
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 1000
gidNumber: 1000
homeDirectory: /home/ldapuser1
# ldapuser1, Group, learnitguide.net
dn: cn=ldapuser1,ou=Group,dc=learnitguide,dc=net
objectClass: posixGroup
objectClass: top
cn: ldapuser1
userPassword:: e2NyeXB0fXg=
gidNumber: 1000
# search result
search: 2
result: 0 Success
# numResponses: 3
# numEntries: 2
From the above output, copy the highlighted details in red color and proceed to the next steps.
Now create a file “usercreate.ldif”, paste the copied content and change the required details for your requirement. I have changed the highlighted parameters and save the file.
[root@node1 ~]# vi usercreate.ldif
dn: uid=newuser1,ou=People,dc=learnitguide,dc=net
uid: newuser1
cn: newuser1
sn: newuser1
mail: newuser1@learnitguide.net
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: {crypt}x
shadowLastChange: 17449
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 1010
gidNumber: 1010
homeDirectory: /home/newuser1
# newuser1, Group, learnitguide.net
dn: cn=newuser1,ou=Group,dc=learnitguide,dc=net
objectClass: posixGroup
objectClass: top
cn: newuser1
userPassword:: e2NyeXB0fXg=
gidNumber: 1010
Lets add the user “newuser1” using the “usercreate.ldif” file into LDAP database using ldapadd command.
[root@node1 ~]# ldapadd -x -W -D “cn=Manager,dc=learnitguide,dc=net” -f /root/usercreate.ldif
Enter LDAP Password:
adding new entry “uid=newuser1,ou=People,dc=learnitguide,dc=net”
[root@node1 ~]#
Enter the Ldap Administrator password when it prompts to enter which was created during the openldap configuration.
lets set a password to the newly added user “newuser1”
[root@node1 ~]# ldappasswd -s newuser1@123 -W -D “cn=Manager,dc=learnitguide,dc=net” -x “uid=newuser1,ou=People,dc=learnitguide,dc=net”
Enter LDAP Password:
[root@node1 ~]#
Again enter the Ldap Administrator password when it prompts to enter which was created during the openldap configuration.
Lets Verify the user “newuser1” LDAP entry.
[root@node1 ~]# ldapsearch -x cn=newuser1 -b dc=learnitguide,dc=net
# extended LDIF
#
# LDAPv3
# base <dc=learnitguide,dc=net> with scope subtree
# filter: cn=newuser1
# requesting: ALL
#
# newuser1, People, learnitguide.net
dn: uid=newuser1,ou=People,dc=learnitguide,dc=net
uid: newuser1
cn: newuser1
sn: newuser1
mail: newuser1@learnitguide.net
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
shadowLastChange: 17449
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 1010
gidNumber: 1010
homeDirectory: /home/newuser1
userPassword:: e1NTSEF9RzFidHhRY1dmR1JyT2xzaVFqd3hYN0Jxc0JBOVd4eU0=
# newuser1, Group, learnitguide.net
dn: cn=newuser1,ou=Group,dc=ourtestdomain,dc=com
objectClass: posixGroup
objectClass: top
cn: newuser1
userPassword:: e2NyeXB0fXg=
gidNumber: 1010
# search result
search: 2
result: 0 Success
# numResponses: 3
# numEntries: 2
Great work, We have got the expected output of a user “newuser1”.
Lets go to the client end and verify the user is able to access or not by making few changes.
Assume that you have already added your client to the Ldap server, if not refer this how to configure linux clients with Openldap Servers.
Just update the ldap configuration to create the home directory when user is logging in as below, else you would get an error as home directory not found.
[root@client1 ~]# authconfig –enablemkhomedir –update
getsebool: SELinux is disabled
Now, Verify the ldap user “newuser1” using the below command.
[root@client1 ~]# getent passwd newuser1
newuser1:x:1010:1010:newuser1:/home/newuser1:/bin/bash
Lets login using the newly created user “newuser1” as below.
[root@client1 ~]# su – newuser1
Creating directory ‘/home/newuser1’.
[newuser1@client1 ~]$ id
uid=1010(newuser1) gid=1010 groups=1010
[newuser1@client1 ~]$
Thats all, we are able to login with the user “newuser1” which was created using ldif file. Repeat the same for more user.
Hope you have got an idea How to Create LDAP Users and Groups using LDIF file.
Goind forward, you will get more articles and stay connected with us to not miss any updates.
Keep practicing and have fun. Leave your comments if any.
Support Us: Share with your friends and groups.
Stay connected with us on social networking sites, Thank you.